CVE-2026-129135: picoquic before 2026.11.05.3e2e3d3 Integer Overflow via TIME_STAMP Frame Decoder
picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquicdecodetimestampframe() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIMESTAMP values. Attackers on connections negotiating the TIMESTAMP extension can send large values shifted by ackdelayexponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running picoquic versions before 2026.11.05.3e2e3d3 are affected when they establish QUIC connections that negotiate the TIME_STAMP extension.
What must an attacker be able to do?
An attacker must act as a remote QUIC peer on a connection negotiating the TIME_STAMP extension and send oversized TIME_STAMP values. The supplied vector indicates no privileges or user interaction are required, but exploitation has high attack complexity.
What is the practical impact of successful exploitation?
The overflow can corrupt stored timestamps, leading to incorrect RTT and bandwidth estimates. This can degrade congestion-control behavior and availability rather than exposing or modifying data.
How can I determine whether an instance needs remediation?
Check whether the deployed picoquic version is earlier than 2026.11.05.3e2e3d3 and whether the instance negotiates the TIME_STAMP extension with remote peers. Instances meeting both conditions are exposed to this issue.